Secure iV-dimensional Simultaneous Dense Coding and Applications 
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Simultaneous dense coding guarantees that Bob and Charlie simultaneously achieve their respec- 
tive information from Alice in their respective processes of dense coding. The idea is to use the 
locking operation to lock the entanglement channels. In this paper, we present some new results on 
simultaneous dense coding: (1) We propose three simultaneous dense coding protocols, which utilize 
different iV-dimensional quantum entanglement (i.e. Bell state, W state and GHZ state). (2) Besides 
the quantum Fourier transform, two new locking operators (i.e. the double controlled-NOT operator 
and the SWAP operator) are introduced. (3) In the case that spatially distant Bob and Charlie must 
implement the unlocking operation through communication, we improve our protocol's fairness by 
implementing the unlocking operation in series of steps. (4) We improve the security of simultaneous 
dense coding against the intercept-resend attack. (5) We show that simultaneous dense coding can 
be used to implement a fair contract signing protocol. (6) We also show that the iV-dimensional 
quantum Fourier transform can act as the locking operator in simultaneous teleportation of quiVits. 

PACS numbers: 03.67.-a, 03.67.Hk 
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I. INTRODUCTION 

At most log 2 -ZV bits of information can be transmitted 
via a quA^it (A^-level quantum system) because of the 
Holevo bound [l|. Dense coding, proposed by Bennett 
and Wiesner in 1992 Js}, increases the classical capacity 
of a quantum communication channel with the help of 
prior entanglement Q. If the sender and the receiver 
share a pair of entangled quAfits, 2 log 2 A~ bits can be 
transmitted via a quMt @. 

In the simplest case of dense coding, two parties, Alice 
and Bob, share in prior a pair of entangled qubits (2-level 
quantum system) in the Bell state. Alice first performs 
one of the four local unitary operations /, <r x , ia y and a z 
(where <jj are the Pauli matrices) on her qubit to encode 2 
bits of information, transforming the entangled pair into 
one of the four mutually orthogonal Bell states. Then 
Alice sends her qubit to Bob through a quantum channel. 
Bob is now able to measure both qubits in the Bell basis 
to obtain one of the four possible outcomes correlated 
with the operations performed by Alice. Thus, Alice can 
transmit 2 bits of information to Bob by manipulating 
and sending only one qubit. 

Thus far, dense coding has been extensively studied 
in various ways. For example, dense coding that utilizes 
high dimensional entangled states has been studied > 
non-maximally entanglement channels 043 and multi- 
partite entanglement channels |l9H26} have also been con- 
sidered; another generalization is to perform the commu- 
nication task under the control of a third party, so called 
controlled dense coding |27H29l j. 

Inspired by the simultaneous teleportation scheme pro- 
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posed by Wang et al [3fJ, we have proposed a simulta- 
neous dense coding (SDC) scheme in Ref. [3l[, which 
guarantees that Bob and Charlie (the receivers) simulta- 
neously achieve their respective information from Alice 
(the sender) in their respective processes of dense coding. 
In this scheme, Alice first performs a locking operation to 
entangle the particles from two independent quantum en- 
tanglement channels, and therefore the receivers cannot 
achieve their information separately before performing 
the unlocking operation together. The quantum Fourier 
transform and its inverse are used as the locking and un- 
locking operators, respectively. 

Simultaneous dense coding may be relevant and useful 
for improvement of some models or tasks of quantum 
communication. In Sec. IVI1 we show that simultaneous 
dense coding can be used to implement a fair contract 
signing protocol [33| between spatially distant Bob and 
Charlie. In this case, Bob and Charlie are separated so 
that there is a problem of how they can implement the 
unlocking operation fairly. We will discuss this problem 
later in Sec. IIIII 

There is another application in which Bob and Char- 
lie can be either close or separated. If Alice has two 
different secrets, one for Bob and another for Charlie, 
she can utilize simultaneous dense coding to guarantee 
that Bob and Charlie simultaneously reveal their respec- 
tive secrets. Bob does not know Charlie's secret and 
vice versa. For example, the boss wants two employees 
to simultaneously carry out two confidential commercial 
activities under the condition that the sensitive informa- 
tion of each activity is only revealed to who is in charge 
of that activity. 

In this paper, we give some new results on simultane- 
ous dense coding and teleportation. In Sec. HH we in- 
troduce the locking operators (i.e. the quantum Fourier 
transform, the double controlled-NOT operator and the 
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SWAP operator) and propose three simultaneous dense 
coding protocols utilizing different TV-dimensional quan- 
tum states (i.e. Bell state, W state, and GHZ state). In 
Sec. IIIIl we improve the fairness of implementing the 
unlocking operation between spatially distant Bob and 
Charlie. In Sec. IIV1 we improve the security of simulta- 
neous dense coding against the intercept-resend attack. 
In Sec. [V] we use the techniques developed in Sec. IIIIl 
and IIVI to construct a simultaneous dense coding proto- 
col that guarantees both fairness and security. In Sec. 
[VTl we show that simultaneous dense coding can be used 
to implement a fair contract signing protocol. In Sec. 
IVIII we show that the A-dimensional quantum Fourier 
transform can act as the locking operator in simultane- 
ous teleportation of quAits. A brief conclusion follows 
in Sec. H7nTl 



II. A?-DIMENSIONAL SIMULTANEOUS DENSE 
CODING 

A quAit is an A-dimensional quantum system. States 
of A-dimensional quantum systems can be mapped onto 
n = log 2 (A) qubits, and throughout the paper we will 
assume that a quAit is realized as an ordered array of 
qubits. We also assume that the dimension A of quAits 
satisfies the requirement A = 2™, with n € N. In other 
words, one quAit consists of (or can be mapped to) n 
qubits. 

In the task of A- dimensional simultaneous dense cod- 
ing (SDC), Alice intends to use dense coding to send two 
cAits (arrays of classical bits) 61, 62 S {0, 1, . . . , N — 1} 
to Bob and two cAits c\,c% £ {0, 1, . . . , A— 1} to Charlie 
under the condition that Bob and Charlie must collabo- 
rate to simultaneously find out what she sends. 

In the following subsections, we propose three proto- 
cols using A-dimensional Bell state, W state, and GHZ 
state as the entanglement channels, respectively. The 
idea of these protocols is to perform the locking opera- 
tor on Alice's quAits before sending them to Bob and 
Charlie. After receiving Alice's quAits, the states of 
Bob's subsystem and Charlie's subsystem are indepen- 
dent of (61,62) and (01,02) so that they know nothing 
about the encoded information. Only after performing 
the unlocking operator (the inverse of the locking oper- 
ator) together, they can achieve (61,62) and (01,02) re- 
spectively. 

In this section, we assume that Bob and Charlie are 
at the same site. In order to implement the unlocking 
operator, they can input their particles into a physical 
device that can unlock the particles, and then get their 
respective output particles. There is a problem of how 
distant Bob and Charlie can perform the unlocking op- 
erator fairly. We will discuss the problem later in Sec. 



A. DCNOT Operators 

Before introducing the protocols, let us first have a 
look at the DCNOT (double controlled-NOT) operator, 
which is used as the locking operator. The DCNOT op- 
erator is composed of two CNOT (controlled-NOT) op- 
erators. The CNOT operator has two input qubits. If 
the first qubit (the control qubit) is 1, CNOT flips the 
second qubit (the target qubit). If the control qubit is 0, 
CNOT does nothing to the target qubit. Its action can 
be described as: 

\x)\y) -> \x)\x®y). (1) 

The DCNOT operator is formed by performing a first 
CNOT with qubit 1 as the control and qubit 2 the target, 
and then a second CNOT with qubit 2 as the control and 
qubit 1 the target. Its action can be described as: 

\x)\y)->\y)\x®y), (2) 

and the inverse DCNOT operator can be described as: 

\x)\y)^\x®y)\x). (3) 

Our quAits \x) Al \v)a 2 are arrays of n qubits, and can 
be written as: 

\xi, . . .,X n )A 1A ...Ai,Jyi, ■ ■ • ,2m)a 2 ,i...a 2 ,„, (4) 

where X ~y • • • X j-^ IS the binary representation of x, and 
yi ... y n is the binary representation of y. 

We define the A-dimensional DCNOT operator by ap- 
plying the DCNOT operator on each pair of Ai,jA2j: 

\xi, . . . , X„) Alil ...A lin \yi, ■ ■ •,y n )Aa,i...A 2 ,n 

-*\yi, ■ ■ ■ ,y n )A t 1...A1 n \xi ®y%,...,x n ® y n )A 2 !...A 2n , 

(5) 

that is, 

l^i \y) a 2 -> \y)A 1 \x ®v)a 2 , (6) 

where x, y € {0, 1, . . . , A— 1}, denotes bitwise addition 
modulo 2. 

Analogously, by applying the inverse DCNOT opera- 
tor on each pair of AijA^j, we have the A-dimcnsional 
inverse DCNOT operator: 

\Xl, ■ ■ ■ )JEn)Ai t i...Ai,nl2/l) • • • ' 2/n) J 4 2 ,i...A2,„ 

-^■\xi®yi,...,x n ®y n )A 11 ...A ln \xi,...,x„)A 21 ...A 2n , 

'(7) 

that is, 

\x)A 1 \y)A 2 ^\x®y) Al \x) A2 . (8) 
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B. SDC Protocol 1: Using iV-dimensional Bell 
State 



Protocol 1 utilizes the following iV-dimensional Bell 
basis [IH, for composite systems of two quiVits 1 and 2: 



N-l 



l0O=i/))u = -t= E e ^ jx \3+y)i\j)^ 

3=0 



(9) 



where x,y E {0, 1, . . . , N — 1}. In the rest of the paper, 
addition and subtraction inside the "|)" notation are done 
modulo N. 

The unitary operators U(xy) can transform |</>(00))i2 
into \cj)(xy)) i 2 : 

(U(xy) ® /) |0(OO))i2 = |0(stf))ia, (10) 



■X : |j> — ► |j + 1) is the shift 
e~ J \j) is the rotation operator. 



where U(xy) = X y Z 
operator, Z : \ j) 

The set {\4>(xy)) i 2 } forms an orthonormal basis of 
completely distinguishable states, and for that reason 
each of its elements can be used to carry information 
(xy). The unitary operators U(xy) are then used to en- 
code that information (xy) into the initial state |0(OO)) 12- 

In the initialization phase of Protocol 1, Alice, Bob and 
Charlie share two pairs of entangled quiVits \4>(00)) Ai b 
and |0(OO)) J 4 2 c, where subscripts A\ and A 2 denote Al- 
ice's two quTVits, subscript B denotes Bob's quiVit and 
subscript C denotes Charlie's quTVit. The initial quan- 
tum state of the composite system is (note that for rea- 
sons of simplicity, we drop the subscript A\BA 2 C for CI 
states |fi(0)) etc.) 



|O(0)) - \<f>(00)) AlB ® M00))a 2 c. 



(11) 



Protocol 1 consists of five steps: 

(1) Encoding. Alice performs unitary operators 
U (bib 2 ) on quATit A\ and U (c\c 2 ) on quiVit A 2 to encode 
(61,62) and (C1.C2), respectively, like the original dense 
coding scheme [2|. After that, the state of the composite 
system becomes 

= u Al (hb 2 ) ®u A2 (c lC2 )\n(o)) 

= \4>{bib 2 )) Al B®\(t>{cic 2 ))A 2 c- (12) 

(2) Locking. Alice performs the DCNOT operator on 
quA^its A\A 2 to lock the entanglement channels. The 
state of the composite system becomes 



\Q 



(2)> = DCNOT AlA2 (|0(6 1 6 2 ))a 1 s ® \4>(cic 2 )) MC 



(13) 



(3) Communication. Alice sends quA/it A\ to Bob 
and quATit A 2 to Charlie, like the original dense coding 
scheme Q. 

(4) Unlocking. Bob and Charlie collaborate to perform 
the inverse DCNOT operator on quATits A\A 2 . The 



state of the composite system becomes 

|0(3)) =DCNOT\ iAa |Q(2)) 

= \(t>(bih)} AlB ® \4>{c lC2 )) A2C . (14) 

(5) Decoding. Bob and Charlie measure quTVits A\B 
and quATits A 2 C in the A^-dimensional Bell basis respec- 
tively to achieve (61,62) and (01,02), like the original 
dense coding scheme [2j. 

The following theorem demonstrates the validity of 
Protocol 1. 

Theorem 1. Neither Bob nor Charlie alone can 
learn the encoded information from the states of their 
subsystems before step 4 (Unlocking) of Protocol 1. 

Proof. After step 2 (Locking), the state of the 
composite system becomes 

/ N-l 

\il(2)) =DCNOT AlM f -j= ]T e 2 ^ \j + b 2 ) Al \j) B 



1 N ~ l 



3=0 

e^^\k + c 2 ) A2 \k) c 



k=0 



N-l 



= l_ £ e ^ Ubl+kci)[k + c2)M 
j,k=0 

\(j+b 2 )(B(k + c 2 )) A2 \j) B \k) c , (15) 
and the reduced density matrix in subsystem A\B is 

N-l 

pmb = E ( A2 (j\ c (k\)\m)(m\(\j)A 2 \k) c ) 

j,k=0 



N-l 

N~ 

I Ai b/N 



N-l 

= -m E \j)AAk) BAl (3\B(k\ 



j,k=0 
2 



(16) 



We can calculate the reduced density matrix in sub- 
system A 2 C in the same way and get p A , 2 c — Ia 2 c/N 2 . 
Because p Al B and p A2 c are independent of (61,62) and 
(cijC 2 ), Bob and Charlie know nothing about the en- 
coded information before step 4 (Unlocking). 



C. SDC Protocol 2: Using iV-dimensional W State 

Li and Qiu [25j presented a sufficient and necessary 
condition for a state of W-class being suitable for perfect 
teleportation and dense coding, and then they general- 
ized the states of W-class to multi-particle systems with 
^-dimension: 

N-l 

\w(oo)) w =—(-/! E b' - + b'°))23 



N ^ 

-l)i |00) 23 



(17) 
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Alice can use unitary operators 



N-l 

U{xy)=Y J ^ {i ' v)x \j-vm (18) 

3=0 

to encode her information: 

\W(xy)) 123 = (u(xy)®I®l)\W(00)} 123 , (19) 

where x, y € {0, 1, . . . , N — 1}. 

In the initialization phase of Protocol 2, Alice, Bob and 
Charlie share two pairs of entangled quAits |IF(00))ai_b 
and |W / (00)) J 4 2 c, where subscript A\ and A 2 denote Al- 
ice's two quAits, subscript B denotes Bob's two quAits 
and subscript C denotes Charlie's two quAits. Protocol 
2 consists of five steps: 

(1) Encoding. Alice performs unitary operators 
U(b\b 2 ) on quAit A\ and U(c\c 2 ) on quAit A 2 to en- 
code (61,62) and (c\,c 2 ), respectively. 

(2) Locking. Alice performs the DCNOT operator on 
quAits A 1 A 2 . 

(3) Communication. Alice sends quAit A\ to Bob and 
quAit A 2 to Charlie. 

(4) Unlocking. Bob and Charlie collaborate to perform 
the inverse DCNOT operator on quAits A\A 2 . 

(5) Decoding. Bob and Charlie make the von Neumann 
measurement using the orthogonal states {|W^(a;y))} on 
quAits A\B and quAits A 2 C respectively to achieve 
(61,62) and (ci,c 2 ). 

The following theorem demonstrates the validity of 
Protocol 2. 

Theorem 2. Neither Bob nor Charlie alone can 
learn the encoded information from the states of their 
subsystems before step 4 (Unlocking) of Protocol 2. 

Proof. The proof is similar to that of Protocol 1. 
After step 2 (Locking), the reduced density matrix 



tfU|(HWO'|B<oo| 



3=0 



PA\B - PA 2 C - N2 
N-l N-l 

+ ^EE b'>Ai(|0*> + \k0))B Al {j\B((0k\ + (k0\) 

k=l j=0 
N-l 

3=0 

Ioomooi + \ jr (|ofc) + |*o» fl «ofc| + (fco|) 



1 

A 



1 

A 



N-l 



k=l 



(20) 



Because p Al B and pa 2 c are independent of (61, 62) and 
(ci,C2), Bob and Charlie know nothing about the en- 
coded information before step 4 ( Unlocking). 



D. SDC Protocol 3: Using iV-dimensional GHZ 
State 



Protocol 3 utilizes the following A-dimensional GHZ 
states [J]: 

N-l 

\GHZ(xy)) 123 = 7= E e ^ X \l + yh\M)™> (21) 
V 3=0 

where x, y € {0, 1, . . . , N - 1}. 

The unitary operators U(xy) can transform 
\GHZ(00)) 123 into \GHZ(xy)) 123 : 



U(xy) ® J® J) \GHZ(00)) 123 = \GHZ(xy)) 123 , (22) 



where U(xy) = XyZ x , X : \j) — > \j + 1) is the shift 
operator, Z : \j) — > e~^\j) is the rotation operator. 

Protocol 3 is similar to Protocol 2 and the proof of its 
validity is similar to that of Protocol 1. 



E. Locking Operators 

In this subsection, we introduce another two lock- 
ing operators: the quantum Fourier transform and the 
SWAP operator. 

The two-quAit quantum Fourier transform is defined 

by 



N-l N-l 



\ x ) A 



\(xN+ v )(]N+k) 



\j)A 1 \k)A 2 



j=0 k=0 



(23) 

The SWAP operator simply swaps two qubits (or 
quAits): 

\ V ) Ai W)a 2 — > W)aAv)a 2 . (24) 

When the A-dimensional quantum Fourier transform 
or the SWAP operator is substituted for the DCNOT op- 
erator in the above three protocols, the states of Bob's 
subsystem and Charlie's subsystem after step 2 (Locking) 
are also independent of (61, 62) and (ci, c 2 ). Neither Bob 
nor Charlie alone can learn the encoded information from 
the states of their subsystems before step 4 ( Unlocking). 
Only after performing the inverse quantum Fourier trans- 
form or the SWAP operator together, they can achieve 
(61,62) and (c\,c 2 ) respectively. 

When the SWAP operator is used as the locking op- 
erator, the protocols become simpler. Step 2 (Locking) 
can be omitted. In step 3 (Communication), Alice sends 
quAit A\ to Charlie and quAit A 2 to Bob. In step 4 ( Un- 
locking), Bob and Charlie swap quAit A\ and quAit A 2 . 
However, if one of the receivers, say Bob, is malicious, 
he can fool Charlie in step 4 ( Unlocking) by detaining 
the quAit that carries (ci,c 2 ) (i.e. quAit A 2 ) and swap- 
ping a randomly prepared fake quAit for the quAit that 
carries (61,62) (i.e. quAit A±). Then Bob can achieve 
(61,62) from quAits A\B, but Charlie cannot achieve 
(ci,C2) because quAit A 2 is still at Bob's side. 
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III. IMPROVING THE FAIRNESS OF SDC 

The clients (Bob and Charlie) can decode the messages 
only by the joint unlocking quantum operation, which re- 
quires either a quantum channel, shared entanglement, or 
direct interaction between them. By "direct interaction" , 
we mean that the clients meet and input their particles 
into a physical device that can unlock the particles, and 
then get their respective output particles. 

In this section, we discuss the problem of achieving 
a global unlocking operation between the distant par- 
ties (Bob and Charlie) by the means of local operations 
and classical communication (LOCC), some prior shared 
resources (such as entanglement, etc.) and/or quantum 
communication. Also, we discuss the problem of the fair- 
ness of the protocol, in case the clients do not trust each 
other. The solution is a probabilistic protocol based on 
sequential exchange of information (quantum, or classi- 
cal with the help of prior shared entanglement) between 
the clients. 



A. The Fairness Problems 

The problem of achieving a global operation by the 
actions of spatially distant clients (Bob and Charlie) 
lies in the fact that the unlocking operation (whether 
it is the inverse DCNOT, quantum Fourier transform or 
SWAP [40]) has a feature that it can entangle initially 
separable states. Since it is impossible to create entan- 
glement by the means of LOCC only, in order to imple- 
ment the unlocking operation, Bob and Charlie have to 
share prior entanglement, or use a quantum channel for 
one of the clients to send his quAit to the other, who 
would then perform the unlocking operation on quAits 
A\Ai locally (i.e. at his site). 

The problem with any such protocol is that it can be 
neither simultaneous, nor symmetric, with respect to the 
two parties involved, which clearly sets an unfair situa- 
tion. 

This is a general problem that arises within asyn- 
chronous distributed networks [37j . Namely, in order to 
achieve the joint operation of the quAits A\A-x, clients 
can each perform local measurements, and then send, 
conditional to the measurement outcomes, (classical or 
quantum) information to the other. Since the clients 
are far apart, it is impossible to achieve simultaneous 
message exchange - the messages are always sent one 
at a time, from one client to the other (the network is 
"asynchronous"). This means that, whatever the proto- 
col that achieves the unlocking operation is, there always 
exists the last message, say from Bob to Charlie. But this 
means that, prior to sending his last message to Charlie, 
Bob has all the right (quantum) information needed to 
obtain his message (61,62), while Charlie does not. This 
is obviously unfair, with respect to Charlie. 



B. The Solution 

The situation is similar to the one presented in the con- 
tract signing problem [33j . The solution, similar to the 
one proposed for quantum contract signing [34| , is to per- 
form the unlocking operation on quAits A\ and A2 (i.e., 
arrays of qubits ^4i : i . . . A\^ n and Ai^\ . . . ^2,n) in series 
of steps, such that after each step, one pair of qubits are 
unlocked. In the course of the unlocking stage, the clients 
increase their probabilities to obtain the needed classical 
information ((61, 62) and (c%, C2), respectively), such that 
at each step one client has slightly higher probability of 
successful recovery than the other. Therefore, the proto- 
col is probabilistic, and also fair in the sense that at each 
step, one client is only slightly privileged over the other. 

The information can be transferred in two equivalent 
ways: either by sending quantum information (qubits) 
via a quantum channel, or by teleporting qubits' quan- 
tum states using LOCC and shared entanglement. With- 
out the loss of generality, we will assume that the clients 
are exchanging the actual qubits, rather than teleporting 
their states. The only difference between the two cases 
is that in the latter case, the clients use the previously 
shared entanglement and exchange classical instead of 
quantum information. 

The main problem in this approach is that a client, 
say Charlie, cannot be sure if Bob sent him the right 
information or not. Therefore, we introduce additional 
2s "control qubits" that would be used by the clients to 
check each other's honesty during the unlocking stage: s 
control qubits would be joined with n "message qubits" 
that carry the message (61,62), to form (n + s) qubits 
A\ t i . . . Ai^ n+S , and given to Bob; other s control qubits 
joined with n message qubits that carry (ci, C2), to form 
^4-2,1 ■ • • A2, n +s and given to Charlie. 

The position pos\ (j) £ {1, 2, . . . , n + s} of each con- 
trol qubit j — 1,2, ...,s within the (ri + s) qubits 
A\ t i . . . A\^ n+a is chosen randomly by Alice and this in- 
formation (s integers pos\(j)) is given to Bob; analo- 
gously, random positions pos2{j) of control qubits from 
^4-2,1 ■ ■ • ^.2,n+s are given to Charlie. 

The control qubits are prepared by Alice in pure states 
and are uncorrelated from the message qubits. The state 
of each control qubit is randomly chosen by Alice from 
a publicly known set S of pure states. S is a set of two 
mutually unbiased bases, computational Z basis {|0), |1)} 
and rotated X basis {]+), |-)}, with |±) = ^(|0) ± |1)); 
therefore, S = {|0), |1), |+), |-)}. The pure state of j- 
th control qubit in the position posi(j) among qubits 
A\ t i . . . Ai_ n+S is statei(j), with statei(j) G S. Analo- 
gously, the states of control qubits from ^2,1 ■ • ■ ^2,n+s 
are encoded by state2(j) G S. Alice gives the information 
{statei(j)\ j — 1,2, ...,s} about the states of control 
qubits from A\i ■ ■ ■ A\_ n+S to Bob, and the information 
{state2(j)\ j — 1,2, ...,s} about the states of control 
qubits from y^i . . . A2 jTl +s to Charlie. 

Therefore, prior to Alice sending the message to 
clients (via sending the qubits A\\ . . . Ai^ n+S to Bob and 
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^2,i • ■ • ^2,n+s to Charlie), Bob has, apart from quTVit 
B, the information {posi(j)\ j = 1, 2, . . . , s} of the posi- 
tions and {statei(j)\ j = 1, 2, . . . , s} of the the states of 
the control qubits from Ai i . . . Ai_ n+S , and analogously 
for Charlie. 

In the initialization phase, Alice, Bob and Charlie 
share two pairs of entangled quiVits, denoted as 

|^(00))a 1 b ® |0(OO))a 2 c (25) 

Alice and Bob also share classical information of the con- 
trol qubits: {pos\{j)\ j = 1,2, . . . , s} and {statei(j)\ j — 
1,2, ... ,s}. Alice and Charlie also share classical infor- 
mation {pos2(j)\ j — l,2,...,s} and {state2(j)\ j = 
1,2,...,*}. 

The protocol of simultaneous dense coding of classical 
messages (61,62) and (c\,C2) works as follows: 

(1) Encoding. Alice performs unitary operators 
£7(6162) on quTVit A\ and U{c\c-i) on quTVit A2 to en- 
code (61,62) and (c\,c 2 ), respectively. 

(2) Locking. Alice joins the s control qubits with n 
message qubits A\,x ■ ■ ■ A\, n , to form the ordered set of 
(n + s) qubits A\ t i . . . Ai, n+S . The j-th control qubit is 
prepared in state\{j) £ S and is in the position pos\(j), 
while the relative positions of the n message qubits are 
the same as before. Analogously, she forms the set 

^2,1 • ■ • ^-2,n+s- 

For j = 1 to n + s, Alice applies the locking operator 
on A lt jA2,j. 

(3) Communication. Alice sends (n + s) qubits 
Ai t i . . . Ai_ n+S to Bob, and (n + s) qubits A%^\ . . . A2, n +a 
to Charlie. 

(4) Unlocking. For j = 1 to n + s, Bob sends qubit 
Aij to Charlie, and then Charlie returns A\j to Bob 
after performing the unlocking operator on A^jA^j at 
his site. 

If 3k,posi(k) = j, Bob measures A\j in either X or Z 
basis, according to statei(k). If the measurement result 
does not match state\{k), he knows that Charlie did not 
return the real Aij and stops the unlocking stage. 

Analogously, if 3k,pos2{k) = j, Charlie measures A2J 
in either X or Z basis, according to state 2 (k). If the mea- 
surement result does not match state2(k), he knows that 
Bob did not send the real A±j and stops the unlocking 
stage. 

Now the remaining n received qubits at Bob's site 
form the ordered set A\ t \ . . . A\_ n , and the remaining 
n received qubits at Charlie's site form the ordered set 
A2,x...A 2 , n . 

(5) Decoding. Bob and Charlie measure quA^its A\B 
and quiVits A2C in the Bell basis respectively to achieve 
(61,62) and (ci,c 2 ). 

The unlocking of qubits Ai,i . . . A\, n+S and 
A2,\ . ■ ■ A 2: n+s is done in (n + s) steps, such that 
in each step one pair of qubits is unlocked. The order 
of qubits must be maintained. Without the loss of 
generality, we assume that the unlocking operation is 
done at Charlie's site. We will assume that Bob is an 
honest client who sends qubits Ai ( i . . . Ai Jll+s to Charlie, 



as long as he is convinced that Charlie is returning the 
exact resulting qubit after the local unlocking operation 
at Charlie's site. The way to check if Charlie is indeed 
doing so is the following: in each step pos\{j) of the 
unlocking stage, Bob measures the state of the qubit 
received in that step in one of the two mutually unbiased 
bases - Z if statei(j) is in {|0), |1)}, X otherwise. If the 
measurement result matches the classical information 
statei(j), i.e. if Bob's outcome is consistent with Charlie 
returning the control qubit in statei(j), Bob continues 
with the unlocking stage. Otherwise, it means that 
Charlie did not return the control qubit in state\{j) and 
Bob stops the unlocking stage. Since Charlie does not 
know the positions of control qubits from Ai ( i . . . Ai in + S , 
he has to return all of the resulting qubits to Bob. 
Otherwise, he will inevitably return some qubits as 
control ones in states different from those prepared by 
Alice, and Bob will, with high probability, be able to 
detect it. 

Note that the whole analysis is done for the ideal case 
where no measurement errors or decoherence effects oc- 
cur. The existence of measurement errors will set the 
threshold value r\ > for the allowed number of obtaining 
wrong results on control qubits (results inconsistent with 
Charlie sending the control qubits in statei(j)), which 
will increase the number s of the control qubits. After 
receiving, in the course of exchange, k < s controlled 
qubits, we require that not more than r\k wrong results 
are obtained. The parameter 77 is determined by the ex- 
perimental set-up, which sets the probability of obtaining 
the wrong result when the right qubit is sent. 

The protocol is optimistic [35| : if both clients are hon- 
est, if they execute the protocol by unlocking the qubits 
Alice gave them, upon finishing the unlocking stage both 
parties will have the whole information sent by Alice. 

Unfortunately, if we insist on the perfect fidelity of 
data transmission, situations when one client (say Char- 
lie) knows that he obtained the whole information, while 
the other hasn't, clearly puts Bob in a disadvantaged sit- 
uation. For example, if the unlocking operation is done 
at Charlie's site, Charlie can decide not to return the last 
resulting qubit to Bob, which would leave him without 
the whole state |0(6i6 2 )) y !i 1 _B, and thus (61,62), in case 
posi(s) < n + s. The perfect fidelity was for the same 
reasons relaxed for quantum contract signing as well, by 
introducing the factor a < 1 of the required fraction of 
correct results for the total number of qubits sent to a 
client [34]]. Therefore, we will also introduce factor a < 1 
and require that a client has correct values of a(2n) mes- 
sage bits sent to him by Alice. 

The above protocol is clearly probabilistic. At each 
step of the unlocking stage, Bob has a finite probability, 
which increases with the execution of the protocol, to 
obtain correct values of 2an bits of the message (61,62) 
that Alice sent him, and analogously for Charlie. 

Due to its probabilistic nature, during the execution of 
the protocol one client is always privileged over the other. 
By privileged, we mean that one client has higher proba- 
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bility of obtaining the required fraction a of the message 
Alice encoded for him, than the other. The difference be- 
tween the clients' probabilities to obtain the information 
sent by Alice is due to the random distribution of con- 
trol qubits. On the other side, since neither of the clients 
know the distribution of both sets of control qubits, even 
though one of them might be privileged over the other at 
a certain step of the unlocking stage, he would not know 
that: the protocol is a priori symmetric with respect to 
the clients. 

Yet, the protocol is fair [36]: throughout the execution, 
one client is only slightly privileged over the other, the 
difference being smaller with the increase of s and could 
be made arbitrarily small for big enough s. The argument 
here is exactly the same as the one presented for the 
fairness of the quantum contract signing protocol [34| . 

Namely, the role of the control qubits is to signal possi- 
ble cheating of a client. By cheating, we mean not sending 
the qubits received by Alice. For example, if one of the 
clients, say Charlie, starts sending qubits each randomly 
in one of four states { 1 0) , 1 1) , | +) , | — ) } , he will send wrong 
message qubits A\ sent by Alice, but also wrong control 
qubits. Therefore, for each control qubit he will have a 
finite probability of 1/2 of being detected cheating (he 
did not send the right control qubit). Therefore, since 
Bob's probability p w to detect a wrong qubit (Charlie's 
cheating) is approaching to one fast, p w = 1 — (l/2) m , 
where m is a number of controlled qubits that are sent as 
random, it is not difficult to estimate the expected dif- 
ference between Bob and Charlie, depending on the total 
number n of message qubits to be sent from one client 
to another and the number s controlled qubits given to 
each client. 

One simply has to estimate the expected value for to, 
the expected number (to) of wrongly sent control qubits 
after which Bob notices the cheating and stops commu- 
nication. During that time, Bob received certain number 
w of random qubits as the message qubits, while Char- 
lie was still receiving the proper ones. Therefore, he is 
in advantage by having about in/ 2 more correct values 
for message bits (even when guessing bit values at ran- 
dom, one has 1/2 of the probability to be correct). The 
number w is an easy function of to, w — w(m), and the 
dependence on to is straightforwardly determined by n 
and s. For big enough n, w((m)) << n and therefore 
Charlie's advantage is negligible. 

Of course, Charlie can try to send qubits in some other 
states (completely random, etc.), but as long as he's not 
sending the right qubits in the right states, there will 
be a finite probability p > that Bob detects cheating 
in a single-shot measurement, so that his probability to 
detect cheating will again exponentially fast approach to 
one in the number of wrongly sent control qubits, mak- 
ing Charlie's privilege arbitrarily small, for big enough 
n. Charlie can try to decrease the value of p, but can 
never make it zero. Otherwise, he would be able to per- 
fectly distinguish between the non-orthogonal states and 
this would violate the security of the BB84 cryptographic 



protocol 



for example. 



In the case of quantum contract signing the role of mes- 
sage and control qubits was given to the same N qubits 
sent by a trusted party (in our case Alice) to clients (in 
our case Bob and Charlie) , while in the case of simulta- 
neous dense coding the two roles are given to separate 
sets of qubits. This will introduce a slight change in the 
expressions for the probabilities involved in calculation, 
but this change is minor, conceptually straightforward to 
calculate and does not affect the main result of protocol's 
fairness. Nevertheless, knowing the exact expressions for 
the probabilities in case of different cheating strategies is 
of crucial importance, and may technically be quite non- 
trivial, which clearly presents interesting and challenging 
topics for future research. 

The fairness condition can be even straightened, as 
was done in [34j], by requiring the negligible probability 
to cheat: the probability that one client has 1cm right 
bits, while the other doesn't. This quantity may be quite 
relevant in various possible scenarios, like in the case of 
signing contracts for buying and selling the goods on the 
market (see |34[). While for a fixed value of a the proba- 
bility to cheat may be as high as 1/4, if it is unknown to 
the clients and chosen randomly by Alice from a certain 
interval 7 aC (1/2,1)) the probability to cheat can be made 
as small as needed, for big enough n (see [13). 

The locking and unlocking operators performed on two 
quAits (i.e., two arrays of qubits) in this section are ac- 
tually products of two-qubit locking and unlocking op- 
erators. The A-dimensional DCNOT operator and the 
SWAP operator are of this kind. But the A-dimensional 
quantum Fourier transform cannot be done qubit (pair )- 
by-qubit(pair). So the quantum Fourier transform can- 
not be used to implement the SDC protocol proposed in 
this section. 



IV. IMPROVING THE SECURITY OF SDC 

Now we consider the security of simultaneous dense 
coding. We assume that in the initialization phase, the 
entangled pairs have been securely distributed among Al- 
ice, Bob and Charlie. Because only part of the entangled 
pairs travel through the quantum channel, an outsider 
knows nothing about the encoded information. If the two 
receivers are honest and follow the protocols exactly, they 
must collaborate to achieve their respective information. 
However, if one of the receivers, say Bob, is dishonest and 
has the ability to intercept and resend the qubits going 
through the quantum channel between Alice and Charlie, 
he can achieve (61,62) without collaborating with Char- 
lie by the following intcrccpt-resend attack: (1) intercept 
quAit A2] (2) perform the unlocking operation on quAits 
A\A 2 ] (3) measure quAits A\B to achieve (61,62); (4) 
perform the locking operation on quAits A\Ai\ (5) send 
quA^it A2 back to Charlie. 

To detect such a cheating behavior, we insert addi- 
tional 2r "detect qubits" into the array of 2n message 
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qubits during the communication phase: r detect qubits 
would be joined with n message qubits that carry the 
message (61, b 2 ), to form (n + r) qubits A\ t \ . . . A\ t7l+r , 
and given to Bob; other r detect qubits joined with n 
message qubits that carry (01,02), to form A 2 .i . . . A 2 , n+r 
and given to Charlie. 

The position pos.D.l(j) e {1, 2, . . . , n + r} of each 
detect qubit j = 1,2, ...,r within the (n + r) qubits 
A\ t \ . . . A\_ n+r is chosen randomly by Alice, and anal- 
ogously for pos.D.2(j) of each detect qubit within 

^2,1 • • • ^2,n+r- 

The state of each detect qubit is randomly cho- 
sen by Alice from set S = {|0), |1), |+), |-)}. S 
is a set of two mutually unbiased bases, computa- 
tional Z basis {|0), |1}} and rotated X basis {|+), |— )}. 
The pure state of j-th detect qubit in the position 
pos.DA(j) among qubits A\,\ . . . Ai_ n+r is state. DA(j), 
with state. DA(j) e S. Analogously, the states of detect 
qubits from A 2 ,i . . . A 2 . n + r are encoded by state. D.2(j) € 
S. 

Only after the transmission of all the message qubits 
and detect qubits, Alice tells Bob and Charlie the posi- 
tions and the bases of the detect qubits and requires them 
to return the measurement results of the detect qubits. 
Therefore Alice can check if the states of the detect qubits 
are changed after the transmission. 

Because the position of the detect qubits in the array 
are chosen randomly by Alice, curious Bob does not know 
which qubits are the message qubits. If his intercept- 
resend attack involves a detect qubit, the state of the 
detect qubit may probably be changed, the probability 
of being detected grows exponentially with the increase 
of r and could be made arbitrarily large for big enough 
r. 

In the initialization phase, Alice, Bob and Charlie 
share two pair of entangled quAits, denoted as 

\<P(00)) Ai b ® |0(OO))a 2 c- (26) 

The protocol of simultaneous dense coding of classical 
messages (61,62) and (ci,c 2 ) works as follows: 

(1) Encoding. Alice performs unitary operators 
U(b\b 2 ) on quAit A\ and U(c\c 2 ) on quAit A 2 to en- 
code (61,62) and (ci,C2), respectively. 

(2) Locking. Alice applies the locking operator on 
quAits A X A 2 . 

(3) Communication. Alice joins the r detect qubits 
with n message qubits A\_\ . . . A\^ n , to form the ordered 
set of (n+r) qubits A\^ . . . Ai in+r . The j-th detect qubit 
is randomly prepared in state. D.l(j) e S and is in the 
position pos.DA(j), while the relative positions of the n 
message qubits are the same as before. Analogously, she 
forms the set A 2j i . . . A 2i „ +r . 

Alice sends (n + r) qubits A\ t \ . . . Ai^ n+r to Bob, and 
(n + r) qubits A 2 ,i . . . A 2yn + r to Charlie. 

Alice waits for Bob and Charlie's acknowledge- 
ments of receiving all the 2(n + r) qubits. Af- 
ter they have sent their acknowledgements through 
unjammable classical communication channel, Alice 



sends {pos.DA(j)\ j = 1,2, ...,r} and the bases of 
{state. DA(j)\ j = 1,2, ...,r} to Bob. Analogously, Al- 
ice sends {pos.D.2(j)\ j = 1,2, ... ,r} and the bases of 
{state. D.2(j)\ j = 1,2,..., r} to Charlie. 

For each j in {pos.DA(k)\ k = 1,2,..., r}, Bob mea- 
sures qubit Aij in either X or Z basis, according to 
state. D A(k)(pos.D A(k) = j), and then returns the mea- 
surement result to Alice. If the measurement result is 
not equal to state. D.l(k), Alice announces that a cheat- 
ing behavior has been detected and stops the protocol. 

Analogously, for each j in {pos. D.2(k)\ k = 1, 2, . . . , r}, 
Charlie measures qubit A 2 j in either X or Z b 
cording to state. D.2(k)(pos.D.2(k) = j), and then re- 
turns the measurement result to Alice. If the measure- 
ment result is not equal to state. D.2(k), Alice announces 
that a cheating behavior has been detected and stops the 
protocol. 

Now the remaining n received qubits at Bob's site 
form the ordered set A\^...A\, n , and the remaining 
n received qubits at Charlie's site form the ordered set 

A 2 .\ . . . A 2l n- 

(4) Unlocking. Bob and Charlie collaborate to perform 
the inverse DC NOT operator on quAits A\A 2 . 

(5) Decoding. Bob and Charlie measure quAits A\B 
and quAits A 2 C in the Bell basis respectively to achieve 
(61,62) and (ci,c 2 ). 



V. COMBINATION OF THE TWO 
STRATEGIES 

In this section, we combine the two strategies described 
in the above two sections in one protocol. Even if the re- 
ceivers have the ability to intercept and resend the qubits 
going through the quantum channel, this protocol can 
detect this behavior. This protocol also guarantees that 
Bob and Charlie can simultaneously decode their respec- 
tive messages fairly through communication. 

In the initialization phase, Alice, Bob and Charlie 
share two pair of entangled quAits, denoted as 

|0(OO)) AlB ® \4>(00)) A2 c. (27) 

Alice and Bob also share classical information of the 
control qubits: {pos.C.l(j)\ j = 1,2, ...,s} and 
{state. C.l(j)\ j = 1,2, ...,s}. Alice and Charlie also 
share classical information {pos.C.2(j)\ j = 1,2, . . . , s} 
and {state.C.2(j)\ j = 1, 2, . . . , s}. 

The protocol of simultaneous dense coding of classical 
messages (61,62) and (ci,c 2 ) works as follows: 

(1) Encoding. Alice performs unitary operators 
U{b\b 2 ) on quTVit A\ and U(c\c 2 ) on quAit A 2 to en- 
code (61,62) and (ci,c 2 ), respectively. 

(2) Locking. Alice joins the s control qubits with n 
message qubits A\ t \ . . . A\ jTl , to form the ordered set of 
(n + s) qubits A\ t \ . . . Ai, n+S . The j-th control qubit 
is prepared in state.C.l(j) G S and is in the position 
pos.C.l(j), while the relative positions of the n message 
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qubits are the same as before. Analogously, she forms 
the set A 2> i ■ . . A 2) „+ s . 

For j = 1 to n + s, Alice applies the locking operator 
on qubits A\^A 2 j. 

(3) Communication. Alice joins the r detect qubits 
with (n+s) message and control qubits Ai t \ . . . Ai t7l+S , to 
form the ordered set of (n+s+r) qubits A\ t i . . . Ai Jl+s+r . 
The j-th detect qubit is prepared in state. D.l(j) 6 S and 
is in the position pos.D.l(j), while the relative positions 
of the remaining (n + s) qubits are the same as before. 
Analogously, she forms the set A2.1 ■ ■ ■ ^-2, n+s+r- 

Alice sends (n + s + r) qubits A\i... Ai tn+s+r to Bob, 
and (n + s + r) qubits A 21 . . . A 2 . n + s +r to Charlie. 

Alice waits for Bob and Charlie's acknowledge- 
ments of receiving all the 2(n + s + r) qubits. Af- 
ter they have sent their acknowledgements through 
unjammable classical communication channel, Alice 
sends {pos. D.l(j)\ j = 1,2, ...,r} and the bases of 
{state. D.l(j)\ j = 1,2, ... ,r} to Bob. Analogously, Al- 
ice sends {pos.D.2(j)\ j — 1,2, ...,r} and the bases of 
{state. D.2(j)\ j = 1, 2, . . . , r} to Charlie. 

For each j in {pos.D.l(k)\ k = 1,2, .. . ,r}, Bob mea- 
sures qubit Aij in either X or Z basis, according to 
state. D.l(k)(pos.D.l(k) — j), and then returns the mea- 
surement result to Alice. If the measurement result is 
not equal to state. D.l(k), Alice announces that a cheat- 
ing behavior has been detected and stops the protocol. 

Analogously, for each j in {pos. D.2(k) \ k = 1,2, ... ,r}, 
Charlie measures qubit A 2 j in either X or Z basis, ac- 
cording to state. D .2(k)(pos .D .2(k) = j), and then re- 
turns the measurement result to Alice. If the measure- 
ment result is not equal to state. D.2(k), Alice announces 
that a cheating behavior has been detected and stops the 
protocol. 

Now the remaining (n + s) received qubits at Bob's site 
form the ordered set A±,i . . .Ai^ n+S , and the remaining 
(n + s) received qubits at Charlie's site form the ordered 
set A 2 .\ . . . A 2 , n +s- 

(4) Unlocking. For j = 1 to n + s, Bob sends qubit Aij 
to Charlie, and then Charlie returns Aij to Bob after 
performing the unlocking operator on qubits A% jAzj at 
his site. 

If 3k,pos.C.l(k) = j, Bob measures qubit A\j in ei- 
ther X or Z basis, according to state.C.l(k). If the mea- 
surement result does not match state. C.l(k), he knows 
that Charlie did not return the real A±j and stops the 
unlocking stage. 

Analogously, if 3k,pos.C.2(k) — j, Charlie mea- 
sures qubit A 2 j in either X or Z basis, according to 
state. C.2(k). If the measurement result does not match 
state. C.2(k), he knows that Bob did not send the real 
A\ t j and stops the unlocking stage. 

Now the remaining n received qubits at Bob's site 
form the ordered set Ai t i...Ai n , and the remaining 
n received qubits at Charlie's site form the ordered set 
A 2 ,i...A 2tn . 

(5) Decoding. Bob and Charlie measure quiVits A\B 
and quAits A 2 C in the Bell basis respectively to achieve 



(61,62) and (ci,c 2 ). 

VI. APPLICATIONS TO CONTRACT SIGNING 

Contract signing [331 ] is a security task involving two 
parties, Charlie and Bob, that do not trust each other 
and want to exchange a common contract signed with 
each other's signature. At the end of the protocol Char- 
lie should have the contract signed by Bob and vice- versa. 
The point of the signed contract is that it binds the par- 
ties to the terms of the contract, which can be enforced 
by a judge (Alice). The real challenge to this problem is 
when both Charlie and Bob are physically apart and want 
to sign remotely the contract. This situation is becoming 
more and more common due to e-business and may lead 
to fraud. For instance, if Bob gets the contract signed by 
Charlie without committing himself Charlie and Bob are 
in an unfair situation. By having Charlie's commitment, 
Bob is able to appeal to Alice to enforce the contract, 
while Charlie has no means to do the same, since he does 
not possess the contract signed by Bob. Note that even if 
Bob did not commit, but having Charlie's commitment, 
puts him in a position to later in time choose whether to 
bind the contract or not, while Charlie has no power to 
do either of the two. 

A simple solution to this unfair situation is to have a 
trusted third party (again Alice) mediating the transac- 
tion - Bob sends to Alice the contract signed by him and 
Charlie does the same, then Alice exchanges the con- 
tracts only after she has received both of the commit- 
ments. Note that this procedure increases significantly 
the cost of remote contract signing, as Alice's time and 
resources are expensive. What is particularly costly is 
Alice being constantly online and alert waiting for the 
clients to contact her. Also, avoiding the communication 
with the trusted party at the very moment of determin- 
ing a contract and committing to it removes the danger 
of overloading Alice and creating a bottleneck. 

Unfortunately, it has been shown that the attendance 
of Alice is mandatory [33j, l37f , if the protocol is to fulfill 
the following two important properties: 

• fairness: either both parties get each other' com- 
mitment or none gets; 

• viability: if both parties behave honestly, they will 
both get each other's commitments. 

One way to overcome this difficulty is to consider opti- 
mistic protocols that do not require communication with 
Alice unless something wrong comes up [35|. Another 
workaround is to relax the fairness condition, allowing 
one agent to have e more probability of binding the con- 
tract than the other agent (probabilistic fairness). In this 
case, for an arbitrary small e solutions have been found 
where the number of exchanged messages between the 
agents is minimized (3r| . 

In this section we present a probabilistically fair quan- 
tum protocol based on SDC for remote agents, described 
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in Section MI B[ In such protocol, Alice, the trusted 
party, does not interact with the signing parties while 
they (Bob and Charlie) are determining the contract and 
then committing to it (the Exchange Phase). 

In order to lower the use of resources, it is possible to 
map long contracts into messages of a small fixed size, 
say of k bits. Such short messages (digests) are obtained 
by so called hash functions (such as SHA1) and are well 
established in the field of cryptography [39| . Hash func- 
tions are not injective, that is, there exist pairs of differ- 
ent messages x, x' with the same digest d. Nevertheless, 
given a message x and its digest d, it is computationally 
hard to find a different message x' ^ x with the same di- 
gest d. For this reason, digests can be used to identify a 
message. From this point on, instead of contracts them- 
selves we consider their digests, obtained by some hash 
function, with k bits, say (61 . . . &/.), where bi £ {0, 1}. 

We also assume that Alice can sign messages using 
some public key signing scheme (such as DSS, for more 
detail see [39j). In short, a public key signature scheme 
for Alice is a pair of functions (sig, ver) together with a 
pair of keys (A, A) where A is the private key of Alice 
(known only by Alice) and A is the corresponding public 
key (known by Alice, Bob and Charlie). For Alice to sign 
a message m she uses her private key A and obtains the 
signature sigA^m). Bob (or Charlie) verifies if sigA{m) 
is the message m signed by Alice by checking whether 
ver^(m, sigA(m)) = 1. If ver^(m, sigA(m)) ^ 1 then 
sigA{m) does not correspond to the signature of Alice 
over to. Signing can be seen as an encryption, unique 
to Alice: only she can do it using her private key A. 
But Bob and Charlie can, given the message m and a 
signature s, by using Alice's public key A verify whether 
s is the signature of to by Alice or not. 

In our contract signing protocol, Alice does not know 
a priori to which particular contract/digest (6i...6jt) 
Bob and Charlie are going to agree upon. However, 
at the end of the protocol Alice (and also Bob and 
Charlie) needs some irrefutable proof of the particular 
contract that was agreed upon. Moreover, we do not 
want Alice to be contacted during the exchange phase. 
A solution for this problem is for Alice to produce 4fc 
triples {{b, i, Bob), (b, i, Charlie) : b G {0, 1}, i = 1 . . . k} 
that can be used to represent any particular contract 
(&i . . . bk) that Bob and Charlie will agree upon latter. 
Next, Alice signs those 4fe triples and prepares 2k SDC 
protocols for Bob and Charlie, where in each of these 
SDC protocols the messages to be simultaneously re- 
ceived are sigA(b, i, Charlie) by Bob and sigA{b, i, Bob) 
by Charlie, with b G {0, 1} and i G {1 . . . k}. 

Thus, Bob can enforce the contract (61 . . .bk) against 
Charlie (and no other person) if he shows to Alice the 
signatures sigA{b\, 1, Charlie) . . . sigA{bk, k, Charlie). 
By using SDC, it is possible to force Bob to ob- 
tain this information (and no other) only with the 
collaboration of Charlie, and vice-versa. In detail the 
contract signing protocol based on SDC works as follows: 



Initialization Phase: 

1. Alice signs the following 4k messages: (0, i, Bob), 
(l,i, Bob), (0, i, Charlie), (1, i, Charlie) with 
i = 1,2,..., k. 

2. Alice arranges for 2k different SDC's for the case of 
distant parties such that the message to be sent to Bob 
in one of such SDC's is sigA(b, i, Charlie) and to Charlie 
is sigA(b, i, Bob) for % = 1,2, ... ,k and b = 0, 1. 

Exchange Phase: 

1. Bob and Charlie agree on contract (b\ . . . bk) € {0, l} k . 

2. For i = 1 to k, Bob and Charlie collaborate to obtain 
from the entangled quNits of the 2k SDC's the messages 
sigA{bi, i, Bob) and sigA{bi, i, Charlie), respectively, for 
i = 1 . . . k and ignore the remaining quantum data 
sent by Alice. Thus, at the end of the SDC's Bob has 
sigA{bi, i, Charlie) for i = l...k and mutatis mutandis 
for Charlie. 

Binding Phase: 

1. Alice enforces contract {b\...bk) when either Bob 
presents sigA{b\, 1, Charlie) ... sigA(bk, k, Charlie) or 
Charlie presents sigA{b\, 1, Bob) . . . sigA{bk, k, Bob). 

The size of each signature, say sigAipi, i, Charlie) is 
given by the length of a message a client receives in each 
SDC, which is 2n bits (the factor 2 comes from the fact 
that the coding is dense). Since each SDC is probabilis- 
tic, a client only needs to present to Alice <Xi(2n) bits, 
with 5 < a i < 1, of the signature sigA(bi, i, Charlie) 
for each i = 1 . . . k. Moreover, if each is random we 
achieve even stronger fairness condition, namely the ex- 
pected probability to cheat on each SDC can be made 
arbitrarily small (the probability to cheat is the prob- 
ability that an agent obtains at least cti(2n) bits of a 
signature and the other does not [34j]). 

The contract signin g pr otocol described above, unlike 
the one presented in [3J], allows for Bob and Charlie 
to determine the contract after the Initialization Phase. 
This is due to the fact that public key signatures were 
introduced. However, this introduction leads to a poorer 
security assumption, as public key signatures are only 
computationally secure (as well as hash functions). 

We can improve the security of the protocol above 
by removing both hash functions and public key signa- 
tures. Removing hash function accounts to consider a 
large enough k such that all potential contracts by Bob 
and Charlie would fit in k bits. To remove public key sig- 
natures, which are not perfectly secure, Alice can, during 
the initialization phase, share a symmetric key kAB with 
Bob and another, kAc-, with Charlie. These symmetric 
keys might be made perfectly secur e by using one-time 
pad cryptosystems (see, for example [39|). Then, in each 
SDC the message that Bob receives is kAB{bi,i,ri(bi)) 
and the message that Charlie receives is kAc{bi, i, i°i(bi)). 
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Here, kAB{fn) is the encryption of m with the symmetric 
key Uab and rj(fej) is a random string for each i and &j, 
sampled and known only by Alice, that is associated to a 
contract between Bob and Charlie. So, for Bob to enforce 
contract (b\ . . . bk) against Charlie, he has to present to 
Alice the random numbers r\{b\) . . . rk(bk). Note that 
in this case Alice has to store all these random numbers 
Ti{bi) in her private memory keeping in mind to whom 
they are associated. In this way the protocol's perfect se- 
curity is obtained by the laws of physics, which is stronger 
than computational security used in classical protocols. 



VII. iV-DIMENSIONAL SIMULTANEOUS 
TELEPORTATIONS 



Recently, a simultaneous quantum state teleportation 
scheme was proposed by Wang et al [3(|, the aim of 
which is for all the receivers to simultaneously obtain 
their respective quantum states from the sender. In their 
scheme, the sender first performs a locking operation to 
entangle the particles from two independent quantum en- 
tanglement channels, and therefore the receivers cannot 
restore their quantum states separately before perform- 
ing the unlocking operation together. The locking oper- 
ator is composed of the Hadamard and the CNOT oper- 
ators. 

Ref. [3l| showed that the quantum Fourier transform 
can alternatively be used as the locking operator in si- 
multaneous teleportation. In this section, we further in- 
vestigate simultaneous teleportation of quA^its using the 
TV-dimensional quantum Fourier transform. 

In the task of A-dimensional simultaneous telepor- 
tation, Alice intends to teleport the unknown quAits 

Wt)T t = YIb^o a t,s\s)T t to Bob t (1 < t < M) under 
the condition that all the receivers must collaborate to 
simultaneously obtain \<pt)Tf 

In the initialization phase, Alice and each Bobt share 
a pair of entangled quAits \4>(QQ)) A t B t , where subscript 
A t denotes Alice's quAit, subscript B t denotes Bob t 's 
quAit. The initial quantum state of the composite sys- 
tem is 

M M 

lx(o)} = (g)|^(oo)) AtSt 0|^) T4 

4=1 t=l 

N M — 1 M 



=f E \j)A 1 ...A M \j)B 1 ...B M <$Z)\(pt)T t , 



t=l 



(28) 



where j is a base-A-number which can be written as 
kh---3M,k €{0,1,...,JV-1}. 

The protocol for simultaneous teleportation of quAits 
consists of five steps: 

(1) Locking. Alice performs the A-dimensional quan- 



tum Fourier transform 
\j)Ai...A m ~ 



N M -1 

= E <& ik \*)M~Au (29) 



fe=0 



on quAits A\ . . . Am to lock the entanglement channels. 
After that, the state of the composite system becomes 



lx(i)> 



N m -1 



: -^== E Q FT M...A M \j)A 1 ...A M \j)B 1 ...B M (g)Wt)T t 



3=0 

N M -1 N M -1 

Tpr E E ^ k \k) Al ...A t 

M 

U)Si...Bjif ($$\<Pt)T t . 
t=l 



t=l 



(30) 



(2) Measuring. Alice measures each pair of quAits 
A t T t in the A-dimcnsional Bell basis. 



M 



1 



A t T t {(t>{xtyt)\x{Vj) 



M N-l 



■ n m X vg) E aAj + vAtM 

\ t=l j=0 / 



N M -1 

E 

k=0 



A I ^ N — 1 

/-l ViV j=0 



1V1 

(®l*t 



e n 



N-l 



N M -1 / M N-l . , 

-nm E nE^'^+ttiwiE^w 

k=Q \ t=l j=Q s=0 

QFT Bl ... BM \k) 



%jQFT Bi ...b m E 



N"-l M 



N M 



Ott,k t -y t \h)B t 



k=0 t=l 

N M -1 M 



)mQFT b ,... Bm E ®^ Xtkt ut.M t \h + yt)B t 



N M 



k=0 t=l 
N M -1 M 

--^mQFT Bi ...b m E (&*uk t X Vt {Z f ) Xt \kt)B t 



k=0 t=l 
M 



N-l 



l m QFT B ,... Bu §§Xy*{tfY* E at,-!*)*, (31) 



n m 



s=0 



where X : \ j) — > \ j + 1) is the shift operator, Z : \j) — > 
e ~^~ J |j) is the rotation operator. 

If the measurement result of quAits A t T t is \4>(x t yt)), 
the state of quAits B\ . . . Bm collapses into 



M 



| X (2)) - QFT Bl ... BM §§Xv*{tfy*\y t ) Bt . (32) 
t=i 
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(3) Communication. Alice sends the measurement re- 
sult (x t ,y t ) to each Bob t . 

(4) Unlocking. All the receivers collaborate to per- 
form the inverse quantum Fourier transform on qu./Vits 
B\ . . . Bm, and the state of quiVits B\ . . . Bm becomes 

lx(3)> = QFTl^ B J X (2)) 

M 

= ®X*(iTt)**|^> Bt . (33) 
t=i 

(5) Recovering. Each Bobt performs Z Xt (X^) Vt on 
quA^it B t to obtain \<pt). 

VIII. CONCLUSIONS 

Teleportation [32j and dense coding Q are important 
quantum communication tasks. Simultaneous teleporta- 
tion [3(| and simultaneous dense coding [3l[ , which guar- 
antee that the receivers simultaneously achieve their re- 
spective information from one sender, may be relevant 
and useful for improvement of some models or tasks of 
quantum communication. In this paper, we have given 
a number of new results on simultaneous dense coding 
and teleportation. More specifically, we have given three 



protocols for simultaneous dense coding utilizing differ- 
ent TV-dimcnsional quantum states (i.e. Bell state, W 
state, and GHZ state). Besides the quantum Fourier 
transform, we have introduced two new locking opera- 
tors (i.e. the double controllcd-NOT operator and the 
SWAP operator) for simultaneous dense coding. Then 
we have analyzed the fairness and the security problem 
of simultaneous dense coding and proposed a protocol 
which guarantees both the fairness and the security. We 
have shown that simultaneous dense coding can be used 
to implement a fair contract signing protocol. In addi- 
tion, we have shown that the TV-dimensional quantum 
Fourier transform can act as the locking operator in si- 
multaneous teleportation of quiVits. 
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The case of the SWAP operation is particularly interest- 
ing. Namely, after Bob and Charlie swap the states of 
qubits A\ and Ai, the very qubits do not become en- 
tangled with each other. Nevertheless, the distant sites 
of Bob and Charlie do become entangled: qubits A\ are 
now entangled with qubits C, while qubits A2 are en- 
tangled with qubits B. The other way to look at this 
is through the no-cloning theorem: there is no way for 
Bob to learn the unknown state of the system A\B and 
transfer (swap) its partial state of Ax together with its 
entanglement with B using only LOCC, without prior 
entanglement shared with Charlie. 



